CVE-2021-22885

Impact

There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the redirect_to or polymorphic_url helper with untrusted user input.

Vulnerable code will look like this.

redirect_to(params[:some_param])

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The FIXED releases are available at the normal locations.

Workarounds

To work around this problem, it is recommended to use an allow list for valid parameters passed from the user. For example,

private def check(param)
  case param
  when "valid"
    param
  else
    "/"
  end
end

def index
  redirect_to(check(params[:some_param]))
end

Or force the user input to be cast to a string like this,

def index
  redirect_to(params[:some_param].to_s)
end

Patches

To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

• 5-2-information-disclosure.patch - Patch for 5.2 series
• 6-0-information-disclosure.patch - Patch for 6.0 series
• 6-1-information-disclosure.patch - Patch for 6.1 series

Please note that only the 5.2, 6.0, and 6.1 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits

Thanks to Benoit Côté-Jodoin from Shopify for reporting this.

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser.

Security Fix(es):

A possible information disclosure/unintended method execution vulnerability in Action Pack >= 2.0.0 when using the redirect_to or polymorphic_urlhelper with untrusted user input.(CVE-2021-22885)

A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the redirect_to or polymorphic_urlhelper with untrusted user input.

This update for rubygem-actionpack-5_1 fixes the following issues:

• CVE-2021-22885: Fixed possible information disclosure / unintended method execution in Action Pack (bsc#1185715).

This update was imported from the SUSE:SLE-15:Update update project.

This update for rubygem-actionpack-5_1 fixes the following issues:

• CVE-2021-22885: Fixed possible information disclosure / unintended method execution in Action Pack (bsc#1185715).

These are all security issues fixed in the ruby2.7-rubygem-actionpack-5.2-5.2.6-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby2.7-rubygem-actionpack-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.1-rubygem-actionpack-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rubygem-actionpack-4_2 fixes the following issues:

• CVE-2021-22885: Fixed possible information disclosure / unintended method execution in Action Pack (bsc#1185715).

This update for rubygem-actionpack-5_1 fixes the following issues:

• CVE-2021-22885: Fixed possible information disclosure / unintended method execution in Action Pack (bsc#1185715).

This update for rubygem-actionpack-3_2 fixes the following issues:

• CVE-2021-22885: Fixed Possible Information Disclosure / Unintended Method Execution in Action Pack (bsc#1185715).
• CVE-2016-2097: Fixed Possible Information Leak Vulnerability in Action View (bsc#968850).